Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-02-28. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
A public-service platform is now an exploitation priority. FortiGuard reports attackers using a flaw to run code remotely on authenticated customers’ IIS servers. Check affected versions, update, and investigate for signs of access. Get the brief → https://secbriefs.com/briefs/active-exploitation-reported-for-trimble-cityworks-cve-2025-0994 https://t.co/0tTCDbOLVS
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | trimble | cityworks | - | - | - |